Forum Discussion
NimbostratusiRule to Allow acess to /wp-admin
Hello guys, I have a site protected by ASM that works on WordPress, it was requested that an exception to be created for the path /wp-admin, because they are receiving several blocks on access to the path, I tried to add the path in the section of URL'S allowed but it did not work, I keep receiving the logs and the blocks keep occurring for the path /wp-admin, is there a way or an iRule to perform a bypass in the path /wp-admin so that it is not blocked access?
Best Regards.
spalandeNacreous
What's your current setup? How do you block /wp-admin currently via an iRule or ASM policy?
Victor_SoaresHello SanjayP! about hardware we are using 2 i2800 (Active - Passive), about the URL we're only using ASM protection on BIG-IP, don't using any other feature like load balancing or something like that. Currently using default ASM policy, without any iRule, i've tryied to input the path on allowe URL'S but without success.
- spalande
If you are using ONLY "ASM" to disallow URL and you want to allow specific URL then
Navigate to Security -> URL's --> disallowed URL's and remove /wp-admin.
If in the allowed URL list (security -> URL -> Allowed URLs) if wildcard (*) is removed, then add the /wp-admin (for explicit) or /wp-admin* for the wildcard.
if you are still receiving ASM blocks, please provid the log snippet for the reason of the ASM block and URL getting blocked.
- Victor_Soares
Hello SanjayP, currently i'm using the allowed urls method, like the image :
At the moment, i had to switch the application to learning mode, but i have an alert after this allowed URL applied and the blocked alert :
Keyword match :
1st Path :
2st Path at the same signature :
Both was blocked with the Allowed URL'S configured like the 1st image.
Thank You.
- Victor_Soares
Both of the alerts are matching at the img tag: src/dynsrc/lowsrc (Parameter) signature in /wp-admin/* path
- spalande
well, it's not getting blocked because you have not allowed the URL.
It's getting blocked because of the ASM signature triggered or HTTP compliance setting (I still can't see the exact reason as you have not shared it). But either way you would need to fine tune the ASM policy further to allow this request.
If you want to completely disable ASM inspection on this path, you can create LTM policy and disable ASM for this path or iRule as below. But the recommended way would be to fine tune ASM policy in learning mode and whitelist the signatures as required on that path
when HTTP_REQUEST { switch -glob [string tolower [HTTP::uri]] { "/wp-admin*" { ASM::disable } default { return } } }
- Victor_Soares
Thank You Sanjay, there is a way to to the same thing applying an rule in local traffic policy ? Like "HTTP URI path contains any of /wp-admin at request then disable asm at request time ? like the image belllow :
- spalande
Yes, you can use LTM policy or iRule to completely bypass ASM.